[[["이해하기 쉬움","easyToUnderstand","thumb-up"],["문제가 해결됨","solvedMyProblem","thumb-up"],["기타","otherUp","thumb-up"]],[["이해하기 어려움","hardToUnderstand","thumb-down"],["잘못된 정보 또는 샘플 코드","incorrectInformationOrSampleCode","thumb-down"],["필요한 정보/샘플이 없음","missingTheInformationSamplesINeed","thumb-down"],["번역 문제","translationIssue","thumb-down"],["기타","otherDown","thumb-down"]],["최종 업데이트: 2025-09-05(UTC)"],[],[],null,["| Premium and Enterprise [service tiers](/security-command-center/docs/service-tiers)\n\nThis document describes a threat finding type in Security Command Center. Threat findings are generated by\n[threat detectors](/security-command-center/docs/concepts-security-sources#threats) when they detect\na potential threat in your cloud resources. For a full list of available threat findings, see [Threat findings index](/security-command-center/docs/threat-findings-index).\n\nOverview\n\nUnexpected processes in the scheduler run queue are present. Such processes are\nin the run queue, but not in the process task list.\n\nHow to respond\n\nTo respond to this finding, do the following:\n\nStep 1: Review finding details\n\n1. Open finding, as directed\n in [Review findings](/security-command-center/docs/how-to-use-vm-threat-detection#findings-vmtd).\n The details panel for the finding opens to the **Summary** tab.\n\n2. On the **Summary** tab, review the information in the following sections:\n\n - **What was detected**, especially the following fields:\n\n - **Kernel rootkit name** : the family name of the rootkit that was detected---for example, `Diamorphine`.\n - **Unexpected kernel code pages**: whether kernel code pages are present in kernel or module code regions where they aren't expected.\n - **Unexpected system call handler**: whether system call handlers are present in kernel or module code regions where they aren't expected.\n - **Affected resource**, especially the following field:\n\n - **Resource full name**: the full resource name of the affected VM instance, including the ID of the project that contains it.\n3. To see the complete JSON for this finding, in the detail view of\n the finding, click the **JSON** tab.\n\nStep 2: Check logs\n\n1. In the Google Cloud console, go to **Logs Explorer**.\n\n [Go to Logs Explorer](https://console.cloud.google.com/logs/query)\n2. On the Google Cloud console toolbar, select the project that contains\n the VM instance, as specified on the **Resource full name** row in\n the **Summary** tab of the finding details.\n\n3. Check the logs for signs of intrusion on the affected VM instance. For\n example, check for suspicious or unknown activities and signs of\n [compromised credentials](/security/compromised-credentials).\n\nStep 3: Review permissions and settings\n\n1. On the **Summary** tab of the finding details, in the **Resource full\n name** field, click the link.\n2. Review the details of the VM instance, including the network and access settings.\n\nStep 4: Inspect the affected VM\n\nFollow the instructions in [Inspect a VM for signs of kernel memory\ntampering](/security-command-center/docs/investigate-vmtd-kernel-tampering-findings).\n\nStep 5: Research attack and response methods\n\n1. Review MITRE ATT\\&CK framework entries for [Defense Evasion](https://attack.mitre.org/tactics/TA0005/).\n2. To develop a response plan, combine your investigation results with MITRE research.\n\nStep 6: Implement your response\n\n\nThe following response plan might be appropriate for this finding, but might also impact operations.\nCarefully evaluate the information you gather in your investigation to determine the best way to\nresolve findings.\n\n1. Contact the owner of the VM.\n\n2. If necessary, [stop the compromised\n instance](/compute/docs/instances/stop-start-instance) and replace it with a\n new instance.\n\n3. For forensic analysis, consider backing up the virtual machines and\n persistent disks. For more information, see [Data protection\n options](/compute/docs/disks/data-protection) in the Compute Engine\n documentation.\n\n4. Delete the VM instance.\n\n5. For further investigation, consider using incident response services like\n [Mandiant](/security/consulting/mandiant-incident-response-services).\n\nWhat's next\n\n- Learn [how to work with threat\n findings in Security Command Center](/security-command-center/docs/how-to-investigate-threats).\n- Refer to the [Threat findings index](/security-command-center/docs/threat-findings-index).\n- Learn how to [review a\n finding](/security-command-center/docs/how-to-investigate-threats#reviewing_findings) through the Google Cloud console.\n- Learn about the [services that\n generate threat findings](/security-command-center/docs/concepts-security-sources#threats)."]]
